UBUNTU-CVE-2026-120436: Buffer Overflow
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that causes heap buffer overflow when computing output buffer size. Attackers can supply a crafted multi-plane JBIG file with large header dimensions so jbgdecmergeplanes() overflows the undersized buffer, causing crashes or potentially code execution.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to get a user or process to run jbigtopnm on a crafted multi-plane JBIG file with large header dimensions. The issue has no privilege requirement, but user interaction is required.
Which Netpbm versions are affected?
Affected versions are Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 releases before 11.15.08.
What can happen if exploitation succeeds?
The integer overflow can make jbigtopnm allocate an undersized output buffer, followed by a heap buffer overflow during plane merging. This can cause a crash or potentially allow code execution.